Home / ubuntu / Questions / 785764
In Process
Andrew Shum
Asked: 2016-06-12 08:07:56 +0800 CST

Where does openssh-server get the "Last Login" information from?

  • 772

Where does openssh-server get the "Last Login" information from?

I recently logged in remotely from a Windows machine using SSH Secure Shell 3.2.9 and the reported last login was from a network location I do not recognize. I then checked auth.log (more specifically, auth.log.1) and found no log entries pertaining to the reported network location. I usually remote in via VPN so I know the IP of the computer logged-in changes. However, it typically takes the form of an IP address where as this particular attempt was recorded as unknownComputerName.knownNetworkName. I find it a bit odd that there is no matching entry in auth.log because I know for a fact that even failed attempts are recorded.

Also, I am new to using Ubuntu and a novice at remote access. That being said, please correct any mistakes I may have made with regards to terminology. Also, please let me know if this type of question is better asked somewhere else.

openssh

1 Answers

  1. There is database in /var/log/lastlog (binary AFAIK). See the manual page for lastlog(8). The file should be updated by the PAM module pam_lastlog(8).

    There might be some difference in what Ubuntu version you are using (I don't have this file, nor the message in my 15.10).

    • 1